github
/
openvpn-gui
mirror of https://github.com/OpenVPN/openvpn-gui
1
0
Fork 0
Code Issues Releases Wiki Activity

Disallow Windows special filenames for imported profile 

Found by ZeroPath

Reported by: Joshua Rogers <joshua@joshua.hu>

Signed-off-by: Selva Nair <selva.nair@gmail.com>
pull/772/head
Selva Nair 2025-10-25 16:26:15 -04:00
parent e6a2836f3c
commit f1b74135f5
1 changed files with 24 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
as.c
View File

@ -39,19 +39,35 @@
#define PROFILE_NAME_TOKEN L"# OVPN_ACCESS_SERVER_PROFILE=" #define PROFILE_NAME_TOKEN L"# OVPN_ACCESS_SERVER_PROFILE="
#define FRIENDLY_NAME_TOKEN L"# OVPN_ACCESS_SERVER_FRIENDLY_NAME=" #define FRIENDLY_NAME_TOKEN L"# OVPN_ACCESS_SERVER_FRIENDLY_NAME="
/** Replace characters not allowed in Windows filenames with '_' */ /** Replace characters not allowed in Windows filenames with '_'
* and replace special names with "TMP"
*/
void void
SanitizeFilename(wchar_t *fname) SanitizeFilename(wchar_t *fname, size_t name_length)
{ {
const wchar_t *reserved = L"<>:\"/\\|?*;"; /* remap these and ascii 1 to 31 */ const wchar_t *reserved = L"<>:\"/\\|?*;"; /* remap these and ascii 1 to 31 */
while (*fname) wchar_t *p = fname;
while (*p)
{ {
wchar_t c = *fname; wchar_t c = *p;
if (c < 32 || wcschr(reserved, c)) if (c < 32 || wcschr(reserved, c))
{ {
*fname = L'_'; *p = L'_';
}
++p;
}
/* Also disallow reserved names */
const wchar_t *special[] = { L"CON", L"PRN", L"AUX", L"NUL", L"COM1", L"COM2",
L"COM3", L"COM4", L"COM5", L"COM6", L"COM7", L"COM8",
L"COM9", L"LPT1", L"LPT2", L"LPT3", L"LPT4", L"LPT5",
L"LPT6", L"LPT7", L"LPT8", L"LPT9" };
for (DWORD i = 0; i < _countof(special); i++)
{
if (wcscmp(fname, special[i]) == 0)
{
wcsncpy_s(fname, name_length, L"TMP", _TRUNCATE);
} }
++fname;
} }
} }
@ -117,7 +133,7 @@ ExtractProfileName(const WCHAR *profile,
out_name[out_name_length - 1] = L'\0'; out_name[out_name_length - 1] = L'\0';
SanitizeFilename(out_name); SanitizeFilename(out_name, out_name_length);
free(buf); free(buf);
} }
@ -424,7 +440,7 @@ ExtractFilenameFromHeader(HINTERNET hRequest, wchar_t *name, size_t len)
} }
} }
SanitizeFilename(name); SanitizeFilename(name, len);
done: done:
free(buf); free(buf);